Autoplay Autoplay HiJack This

Hi All,
Am having trouble with Autoplay taking over my pc. This happens all the time and not just when discs are being used. Sometimes windows explorer will show as many as 15 instances of Autoplay all at the same time. I have posted a message on the XP site about this and was advised to use HijackThis and post the log file here in the hope that some of you smarter guys than me can help.
So here it is. I have had to chop a bit off as it was over 10000 characters long.
Anything else you need I can post seperately if needed.
Cheers  Frank




R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
O3 - Toolbar: SYSTRAN Web Translator 5.0  - {A5899B52-3AF9-4F56-85FE-AD7B3BE8490F} - C:\Program Files\SYSTRAN\5.0\Personal\IEPlugIn.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: FAXRX.lnk = C:\Program Files\Brother\Brmfl06a\FAXRX.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: Casino-on-Net  - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~2\pacificpoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Medion-UK - {725E17C7-2B9A-42BA-AAE2-754FA08120BD} - http://www.medion.co.uk (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {0F42F280-2D6E-4B19-95A9-18D8DADB9309} (BFLauncher Class) - http://www.betfred.com/company/gamessections/common/betfredlauncher.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {48C20DEE-B00A-11D4-9B2F-0060975D990E} (Hi2Lobby Class) - http://80.253.105.3/lobby/atlclient.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://mirror.worldwinner.com/games/v45/wordmojo/wordmojo.cab
O16 - DPF: {CF164902-C4C0-426a-87B3-FB140274E15F} (Dixons PSA) - http://www.gtwebcheck.com/pcworld/28/install/gtdowndi.cab
O16 - DPF: {F04F4F32-6457-401A-8169-D2773DDFF930} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1uk.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DEC5791-58D3-4F8D-9143-6A999B9C0C73}: NameServer = 195.92.195.90 195.92.195.91
O18 - Filter hijack: text/html - {8A8A75D8-C7AD-4C49-87E0-85601BD18621} - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--

[Moderator]

The chopped off info is needed as well...use 2 posts if need be.

Ok, thanks.

This is the top part of the log. Hope it helps

Thanks

Frank




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53:44, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\Brmfl06a\FAXRX.exe
C:\WINDOWS\DitExp.exe
C:\OPLIMIT\ocrawr32.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\PROGRA~1\SYSTRAN\5.0\Personal\SYSTRA~1.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

[Malware Removal Specialist]

* Please download Combofix by sUBs. Place it on your Desktop. combofix.exe
* Double click combofix.exe & follow the prompts. Enter 1 and press enter at the prompt.
* When finished, it shall produce a log for you. Attach that log in your next reply.
Combofix will create a backup to anything removed in C:\qoovox

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Ok evilfantasy, thanks. Here goes......

The Autoplay box appeared for about 20 to 30 times whilst the AutoScan programme was running. At one stage the task bar showed windows explorer with a 6 in front of it. Presumably the number of instances the Autoplay was running.

Hope it makes sense to you.....Cheers   Frank





ComboFix 07-11-08.3 - Cliffnook 2007-11-14  6:18:40.1 - NTFSx86
Running from: C:\Documents and Settings\Cliffnook\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\Downloaded Program Files.\hotbar.inf

.
(((((((((((((((((((((((((   Files Created from 2007-10-14 to 2007-11-14  )))))))))))))))))))))))))))))))
.

2007-11-14 06:16   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-11-14 05:54   <DIR>   d--------   C:\WINDOWS\LastGood
2007-11-14 05:54   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
2007-11-14 05:54   207,736   --a------   C:\WINDOWS\system32\muweb.dll
2007-11-13 09:54   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
2007-11-13 09:52   2,297,552   --a------   C:\WINDOWS\system32\d3dx9_26.dll
2007-11-13 09:48   <DIR>   d--h-----   C:\WINDOWS\msdownld.tmp
2007-11-13 06:57   <DIR>   d--------   C:\Documents and Settings\Cliffnook\SecurityScans
2007-11-13 06:56   <DIR>   d--------   C:\Program Files\Microsoft Baseline Security Analyzer 2
2007-11-12 07:09   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\Oberon Media
2007-11-12 06:49   <DIR>   d--------   C:\Program Files\Trend Micro
2007-11-09 09:40   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\VSRevoGroup
2007-11-09 09:35   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\RFA_Backups
2007-11-07 06:41   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\MinigolfAdventures
2007-11-05 06:50   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\ForgottenRiddles
2007-11-01 09:39   <DIR>   d--------   C:\Program Files\NovaLogic
2007-10-31 06:22   <DIR>   d--------   C:\Program Files\Oberon Media
2007-10-23 05:16   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Innovative Solutions
2007-10-22 06:14   <DIR>   d--------   C:\Program Files\VS Revo Group
2007-10-22 06:11   <DIR>   d--------   C:\Program Files\Your Uninstaller 2006
2007-10-22 06:11   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\URSoft
2007-10-19 06:49   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\iolo
2007-10-18 09:36   <DIR>   d--------   C:\Program Files\CCleaner
2007-10-16 06:19   <DIR>   d--------   C:\Program Files\Croteam

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 10:46   ---------   d-----w   C:\Program Files\SpywareBlaster
2007-11-13 10:41   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-12 07:34   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-11-12 07:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Oberon Media
2007-11-09 10:29   ---------   d-----w   C:\Program Files\Betfred Poker
2007-11-09 09:34   ---------   d-----w   C:\Program Files\Common Files\Oberon Media
2007-11-09 09:34   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\Pogo Games
2007-11-09 09:02   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\PlayFirst
2007-11-07 08:07   ---------   d-----w   C:\Program Files\Microsoft Money
2007-11-05 06:13   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\PlayFirst
2007-10-23 08:44   ---------   d-----w   C:\Program Files\PhotoDeluxe 2.0
2007-10-23 08:44   ---------   d-----w   C:\Program Files\Classic PhoneTools
2007-10-22 08:43   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\PokerChamps
2007-10-22 03:37   17,928   ----a-w   C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-12 15:14   3,734,536   ----a-w   C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 15:14   1,374,232   ----a-w   C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-12 10:31   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\AstroMenace
2007-10-02 09:56   444,776   ----a-w   C:\WINDOWS\system32\d3dx10_36.dll
2007-10-02 07:56   ---------   d-----w   C:\Program Files\Google
2007-10-01 05:47   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\VeniceMysteryData
2007-09-28 08:25   ---------   d-----w   C:\Program Files\Family Tree Maker 2006
2007-09-24 07:03   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\SugarGames
2007-09-20 12:16   ---------   d-----w   C:\Program Files\PacificPoker4
2007-09-20 12:12   ---------   d-----w   C:\Program Files\PacificPoker
2007-09-14 06:36   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\Big Fish Games
2007-08-21 06:15   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-05-01 13:25   7,802   ----a-w   C:\Documents and Settings\Cliffnook\Application Data\wklnhst.dat
2006-08-25 08:24   1,388   ----a-w   C:\Documents and Settings\Cliffnook\Application Data\ViewerApp.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16]
"nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2002-08-15 10:46 C:\WINDOWS\SOUNDMAN.EXE]
"Dit"="Dit.exe" [2002-08-28 12:43 C:\WINDOWS\Dit.exe]
"NeroCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 09:50]
"Agent"="C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe" [2002-09-26 15:49]
"CapFax"="C:\Program Files\Classic PhoneTools\CapFax.EXE" [2001-12-10 16:34]
"POINTER"="point32.exe" []
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-09 23:11]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-10-26 05:37]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-12-17 23:20]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-12 08:54]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 13:25]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 13:45]
"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-06-28 06:46]
"SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 17:02]
"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 11:18]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 11:00]
"STManager"="C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" [2003-10-16 13:25]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []

C:\Documents and Settings\Cliffnook\Start Menu\Programs\Startup\
FAXRX.lnk - C:\Program Files\Brother\Brmfl06a\FAXRX.exe [2007-09-05 07:43:46]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Windows Desktop Search.lnk - C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe [2005-09-20 17:10:04]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2003-07-22 10:39:53]

R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys
R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys
R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys
R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys
S2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
S3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys
S3 IIUSBISP;USB Mass Storage for USB ISP;C:\WINDOWS\system32\Drivers\iiusbisp.sys
S3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\system32\DRIVERS\ctxs51.sys
S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys
S3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-14 06:21:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-14  6:22:09
.
   --- E O F ---

[Malware Removal Specialist]

Please download ATF Cleaner by Atribune. ATF Cleaner.exe This program does not require an installation. The executable actually runs the program.

NOTE: ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser
* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

==========

Please read carefully

Run the BitDefender Online Scanner
Agree to the license and then select Scan.
DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED.
That will make your logs huge and we don't need to see clean files.

Once Bitdefender completes the scan:
Click-on the Detected Problems tab.
Then select Click here to export the scan report.

When the window comes up to save the report, change the Save as type: box to:
Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save.

This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later).
This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.

Post the bdscan.txt file.

==========
Next post please add
BitDefender log
New HijackThis log

Tell me how things are now

Ok ...Done all that but the files are a bit big and i'm probably going to need 4 replies to get them both across. Is this ok or is there a way to send as attachments?

Cheers Frank

[Moderator]

Frank you can use as many as are needed....

[BitDefender Online Scanner]

Ok Patio...thanks.
Here goes then......bdscan.txt file will be first two posts and new HiJackThis will be next 2
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner -Scan Report</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<meta name="generator" content="Namo WebEditor v5.0(Trial)">
</HEAD>
<BODY BGCOLOR=#FFFFFF  leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >


<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
    <tr>
        <td width="458">
            <p><font face="Arial" color=red><span style="font-size:14pt;">BitDefender
            Online Scanner</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>
    <tr>
        <td colspan="3" width="912">
            <p><font face="Arial"><span style="font-size:11pt;"><B>Scan report generated
            at: Wed, Nov 14, 2007 - 12:32:40</span></font></p>
        </td>
    </tr>

   <tr>
        <td width="458">
            <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
            <p><font face="Arial"><span style="font-size:11pt;"><B>Scan
            path: </span><span style="font-size:10pt;">A:\;C:\:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
            <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

    <tr>
        <td width="458">
                <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                    <tr>
                        <td width="451" colspan="2" bgcolor="#CCCCCC">
                            <p><font face="Arial" size="2"><B>Statistics</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Time</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">01:09:25</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Files</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">285820</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Folders</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">7494</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Boot Sectors</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">5</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Archives</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">8698</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Packed Files</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">10319</font></p>
                        </td>
                    </tr>
                </table>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   

   <tr>
        <td width="458">
                <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                    <tr>
                        <td width="451" colspan="2" bgcolor="#CCCCCC">
                            <p><font face="Arial" size="2"><B>Results</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Identified Viruses </font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">2</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Infected Files </font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">2</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Suspect&nbsp;Files </font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">0</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Warnings</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">0</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Disinfected</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">0</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Deleted Files</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">2</font></p>
                        </td>
                    </tr>
                </table>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
                <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                    <tr>
                        <td width="451" colspan="2" bgcolor="#CCCCCC">
                            <p><font face="Arial" size="2"><B>Engines Info</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Virus Definitions</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">872698</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Engine build</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)</font></p>
                        </td>
                    </tr>
                    <tr>
         

[<font size="2" face="Arial">&nbsp;Status</font>]

<td width="57%">
                            <p><font face="Arial" size="2">Scan plugins</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">14</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Archive plugins</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">38</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Unpack plugins</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">7</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">E-mail plugins</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">6</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">System&nbsp;plugins</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">1</font></p>
                        </td>
                    </tr>
                </table>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
                <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                    <tr>
                        <td width="451" colspan="2" bgcolor="#CCCCCC">
                            <p><font face="Arial" size="2"><B>Scan Settings</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">First Action</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Disinfect</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                        <p><font face="Arial" size="2">Second Action</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Delete</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Heuristics</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Enable Warnings</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                   <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scanned Extensions</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">*;</font></p>
                        </td>
                    </tr>

                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Exclude Extensions</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">&nbsp;</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scan Emails</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scan Archives</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scan Packed</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scan Files</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                    <tr>
                        <td width="57%">
                            <p><font face="Arial" size="2">Scan Boot</font></p>
                        </td>
                        <td width="43%" align="right">
                            <p><font face="Arial" size="2">Yes</font></p>
                        </td>
                    </tr>
                </table>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td colspan=2> &nbsp;
                <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                    <tr>
                        <td width="252" bgcolor="#CCCCCC">
                            <p><font face="Arial" size="2"><B>Scanned File</font></p>
                        </td>
                        <td width="195" bgcolor="#CCCCCC" align="right">
                        <p align="left"><font size="2" face="Arial">&nbsp;Status</font></p>
                        </td>
                    </tr>
                    <tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Infected with: DeepScan:Generic.Malware.dld!!.0053513A</font></p>
   </td>
</tr><tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Disinfection failed</font></p>
   </td>
</tr><tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Deleted</font></p>
   </td>
</tr><tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Infected with: Trojan.Dloader.VP</font></p>
   </td>
</tr><tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Disinfection failed</font></p>
   </td>
</tr><tr>
   <td width="57%">
   <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
   </td>
   <td width="43%" align="left">
      <p><font face="Arial" size="2">Deleted</font></p>
   </td>
</tr>
                </table>
        </td>
       
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
            <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

   <tr>
        <td width="458">
            <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
        </td>
        <td width="40%">
            <p>&nbsp;</p>
        </td>
        <td width="10%">
            <p>&nbsp;</p>
        </td>
    </tr>

</table>
<p>&nbsp;</p>

</body>
</html>

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:57:33, on 14/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\OPLIMIT\ocrawr32.exe
C:\Program Files\Brother\Brmfl06a\FAXRX.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\SYSTRAN\5.0\Personal\SYSTRA~1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
O3 - Toolbar: SYSTRAN Web Translator 5.0  - {A5899B52-3AF9-4F56-85FE-AD7B3BE8490F} - C:\Program Files\SYSTRAN\5.0\Personal\IEPlugIn.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: FAXRX.lnk = C:\Program Files\Brother\Brmfl06a\FAXRX.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O9 - Extra button: Casino-on-Net  - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~2\pacificpoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Medion-UK - {725E17C7-2B9A-42BA-AAE2-754FA08120BD} - http://www.medion.co.uk (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {0F42F280-2D6E-4B19-95A9-18D8DADB9309} (BFLauncher Class) - http://www.betfred.com/company/gamessections/common/betfredlauncher.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {48C20DEE-B00A-11D4-9B2F-0060975D990E} (Hi2Lobby Class) - http://80.253.105.3/lobby/atlclient.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://mirror.worldwinner.com/games/v45/wordmojo/wordmojo.cab
O16 - DPF: {CF164902-C4C0-426a-87B3-FB140274E15F} (Dixons PSA) - http://www.gtwebcheck.com/pcworld/28/install/gtdowndi.cab
O16 - DPF: {F04F4F32-6457-401A-8169-D2773DDFF930} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1uk.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DEC5791-58D3-4F8D-9143-6A999B9C0C73}: NameServer = 195.92.195.91 195.92.195.90
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 10429 bytes

Hope i've done it right. If not I'll just have to give it another go.

Cheers Frank

[Malware Removal Specialist]

The Bitdefender removed a couple of nasties so we are getting there.


Couple of questions.

Wanadoo toolbar <---Is this something you installed and do you use it?

More info on this toolbar ---> Click here

Boonty Games <---Is this something you installed and do you use it?

More info on this ---> Click here

I think it is best we remove these.

Also how are things now?

Ok, to answer your questions.

My service provider is Wanadoo (now orange) and this was presumably installed when I first started using this service. I need a toolbar but it doesn't have to be this one.

Boonty games can go. It must be still there from when I downloaded a trial from the internet.

I will need some advice on how to get rid of these and what toolbar would you suggest instead

Unfortunately, although the pc does seem to be running faster, I have still the same problems with Autoplay.

You guys obviously know your business and I feel more confident now that we will get there in the end.

Thanks for all your help so far

Cheers  Frank

[Malware Removal Specialist]

OK, lets tackle the Autoplay first. I wanted to make sure there was no malware to interfere with any fixes we attempt with it.

The Wanadoo I will look into but I do know the Boonty will involve some detailed removal instructions.

Anyway.....this should be pain free

Use the Autoplay Repair Wizard

Let me know how that goes.